US7788716B2 - Token handler API - Google Patents

Token handler API Download PDF

Info

Publication number
US7788716B2
US7788716B2 US11131554 US13155405A US7788716B2 US 7788716 B2 US7788716 B2 US 7788716B2 US 11131554 US11131554 US 11131554 US 13155405 A US13155405 A US 13155405A US 7788716 B2 US7788716 B2 US 7788716B2
Authority
US
Grant status
Grant
Patent type
Prior art keywords
security
messages
web services
token
soap
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US11131554
Other versions
US20050273844A1 (en )
Inventor
Peter Dapkus
Corinna Witt
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Oracle International Corp
Original Assignee
BEA Systems Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Grant date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network
    • H04L63/0823Network architectures or network communication protocols for network security for supporting authentication of entities communicating through a packet data network using certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/02Network-specific arrangements or communication protocols supporting networked applications involving the use of web-based technology, e.g. hyper text transfer protocol [HTTP]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Application independent communication protocol aspects or techniques in packet data networks
    • H04L69/30Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32High level architectural aspects of 7-layer open systems interconnection [OSI] type protocol stacks
    • H04L69/322Aspects of intra-layer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329Aspects of intra-layer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer, i.e. layer seven

Abstract

A token handler API which can be instantiated to allow for custom token types. The token handler API can interact with a web service security handler and security service provider interfaces of security framework in order to do a number of security functions such as authentication, digital signatures and encryption for SOAP messages in a Web Service security system.

Description

CLAIM OF PRIORITY

This application claims priority to U.S. Provisional Application No. 60/573,268 entitled “Token Handler API” filed May 21, 2004.

FIELD OF INVENTION

The present invention relates to web service security systems.

BACKGROUND OF INVENTION

Web Services (WS) allow applications to share data, and to invoke capabilities from other applications without regard to how those applications were built, what operating system or platform they run on, and what devices are used to access them. Web Services are invoked over the Internet by means of industry-standard protocols including the Simple Object Access Protocol (SOAP); the eXtensible Markup Language (XML); and Universal Description, Discovery, and Integration (UDDI).

SOAP is an XML-based messaging technology standardized by the World Wide Web Consortium (W3C), which specifies the rules for locating Web services, integrating them into applications, and communicating between them. UDDI is a public registry where one can publish and inquire about Web services.

Web services security is also defined by standards. The Organization for the Advancement of Structured Information Standards (OASIS) has produced the SOAP message security standard. Part of the standard is the use of security tokens. These tokens are typically defined or referenced in the header of the SOAP message. The security tokens can be used for message authentication, digital signature and encryption/decryption. The specification defines a number of token types including User/Password pairs, X.509 certificates and Kerbos tickets.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram that illustrates one embodiment of a web services security system of the present invention.

FIG. 2 is a diagram illustrating security token processing in one embodiment of the present invention.

FIG. 3 is a diagram of a token handler API of one embodiment of the present invention.

FIG. 4 is a UML document for the example of FIG. 3.

DETAILED DESCRIPTION

FIG. 1 is a diagram that illustrates one embodiment of a web services security system 100 of one embodiment of the present invention. The web services security system 100 uses a security token to determine authorization for the use of a Web Service. The web services security system 100 can include a web services security handler 102. The web services security handler 102 can obtain tokens from the SOAP messages 104. A token handler Application Programming Interface (API) 106 can interact with the web services security handler 102.

The token handler API 106 can be instantiated to define custom security token types for Web Services. This allows newly developed token standards to be implemented without affecting the SSPI or web services security handler 102 or security service provider interface. The token handler API 106 allows designers to customize the token types used with the SOAP messages without recompiling the entire web services software. Updates for new token types can be added as new instances of the token handler API on a web page such as a developer web page. Different instances of the credential mapper SSPI 110 and/or identify assert SSPI 112 can be also created from the customer token type.

A security service provider interface (SSPI), such as the credential mapper SSPI 110, identity assert SSPI 112 or certificate lookup and validation SSPI 114, can interact with the token handler API. The token handler API 106 can use pre-written or customized SSPIs.

The SSPI can connect to or be part of a security framework such as the security framework in WebLogic Server™ or WebLogic Enterprise Security™ available from BEA Systems, Inc. of San Jose, Calif.

The token handler API 106 can include a number of sub-interfaces. The token handler API 106 can convert token XML into java object credentials for processing by the SSPI. The headers of the SOAP messages include tokens or references to tokens.

Looking at FIG. 1, a SOAP message 104 comes to the web service 120. In the Web Services logic 120 is a Web Service security handler 102. The Web Service Security Handler can provide tokens to the token handler API 106. Other handlers 122 for operating on incoming SOAP messages and constructing out going SOAP messages can also be used. The token handler API 106 and SSPI 110, 112 and 114 can be used for authorization, digital signatures and encryption. In one embodiment, the token handler API 106 and SSPIs and security framework 124 checks the authorization before the web service 120 provides a response to a user. The Web Service 120 can use the binding function 126 and Enterprise Java Beans (EJBs) 128.

FIG. 2 illustrates the use of security tokens in one embodiment of the present invention for web service security.

FIG. 3 illustrates one example of a token handler API 300 of one embodiment of the present invention. In this example, a credential provider can use the credential mapper to get credentials based upon a token. The security token handler 304 can include a security token provider 306 and security token factory 308 creating security tokens; a Security Token Reference Provider 310 and Security Token Reference Factory 312 for creating a security token referencess (security token references can be obtained from the SOAP message header in some embodiments); and, a Security Token Processor 314 that can be used to validate security tokens and create keys and subjects from the security token. The keys and subjects can be used in digital signatures and encryption.

FIG. 4 is a diagram of a Unified Modeling Language (UML) representation of the token handle API of FIG. 3. The description is given as a non-limiting example in one embodiment.

Details of an Exemplary Embodiment

Message security can include integrity to ensure that the message or part of the message received has not been altered in transit. This can be implemented using digital signatures. Message security can include confidentiality to ensure that no one besides the sender and recipient can read the contents of the message or parts of the message. This can be implemented using encryption. Message security can include authentication to ensure that the person who claims to have sent/signed/encrypted the data is really the one who did send/sign/encrypt it. This can be implemented by the inclusion in the message of

    • 1. security tokens which assert identity.
    • 2. some kind of proof that the person whose identity is asserted is actually the author of the data (such as signing part of data along with a timestamp)

The concept of message-level authentication can apply to both the entire message and to specific parts of the message which may have been authenticated by a different person than the sender.

Digital Signatures (Dsig) and encryption can use security tokens that are included in the SOAP message. These security tokens can be of various types which are defined in auxiliary WS-Security “profiles”. Auxiliary WS-Security “profiles” can include:

    • UsernameToken profile
    • X.509 Certificate Token profile, including certificate chains
    • SAML Token profile
    • User defined tokens

The choice(s) of what token type is supported is part of the security policy of a web service and can be set from a server console, such as an administration console for the WebLogic Server™ available from BEA Systems, Inc., of San Jose, Calif.

There are several types of configuration of security tokens one might choose to do:

    • 1. whether to enable or disable a particular token type
    • 2. whether to enable a particular token type for use in authentication of the sender
    • 3. necessary conditions for using the token for authentication (e.g. for x509, what must be signed)
    • 4. what precedence of token types should be used if more than one token type is present that could be used for authentication of the sender. For Example, if two or more tokens of the same type are present, the runtime can choose the first one found in the message for authentication.

Configuration mechanisms in a server console can be used for all of these possibilities.

Custom token types are not uncommon because users frequently define their own authentication schemes. A TokenHandler API 106 can be used to define and integrate custom security token types. This API can support attaching additional user-defined information to the security context that is associated with the message.

In one embodiment, Token handler methods include:

Token handler methods:

    • serialize( )
    • deserialize( )
    • extendcontext( )
    • validate( )
    • authenticate( )

The WS-Security Custom Token Provider Interfaces (WSS TPI) can include SecurityToken; SecurityTokenReference; SecurityTokenHandler which extends the sub-interfaces: SecurityTokenFactory, SecurityTokenReferenceFactory, SecurityTokenProvider, SecurityTokenReferenceProvider, SecurityTokenProcessor; and CredentialProvider. The WS-Security Custom Token Provider Interfaces can reuse SPI interfaces for the CredentialMapper and IdentityAsserter.

SPI interfaces can be integrated into the WSS TPI. For example, the CredentialMapper SPI can be integrated into the WSS TPI CredentialProvider. A getCredential method for WSS TPI can use a getcredential method from the CredentialMapper SPI on the server side where a subject is available. The WSS TPI implementor can use policy information to determine if a credential from CredentialMapper can/should be used (e.g. in case the SecurityToken assertion has only token type info, use the current subject to get credential from the CredentialMapper; else get the credential from the CredentialMapper in anyway and use it if it matches issuerName and claims).

The IdentityAsserter SPI can be integrated into the WSS TPI SecurityTokenProcessor. The SecurityTokenProcessor method Subject getSubject(SecurityToken token) can be replaced with Object getCredential(SecurityToken token, ContextHandler ctxHandler). The ContextHandler can be used to pass information that might be needed to validate the token or derive the credential from it (the SOAP message, XMLSignature and EncrpytedType objects created from it); the call is made after the whole header has been processed; call depends on config info. The WSS runtime can use the obtained credential to call PrincipalAuthenticator.assertIdentity (String tokenType, Object token, ContextHandler contextHandler). This will call the IdentityAsserter configured for the tokenType; implementors of WSS TPI can either map their WSS tokenType to aleady existing security tokenTypes or implement and register a custom IdentityAsserter for their tokenType.

The custom IdentityAsserter can return a CallbackHandler that can handle NameCallback, filling in the user name from the token that has been passed in to IdentityAsserter

Embodiments of the present invention may be implemented using a conventional general purpose or a specialized digital computer or microprocessor(s) programmed according to the teachings of the present disclosure, as will be apparent to those skilled in the computer art. Appropriate software coding can readily be prepared by skilled programmers based on the teachings of the present disclosure, as will be apparent to those skilled in the software art. The invention may also be implemented by the preparation of integrated circuits or by interconnecting an appropriate network of conventional component circuits, as will be readily apparent to those skilled in the art.

One embodiment includes a computer program product which is a storage medium (media) having instructions stored thereon/in which can be used to program a computer to perform any of the features presented herein. The storage medium can include, but is not limited to, any type of disk including floppy disks, optical discs, DVD, CD-ROMs, micro drive, and magneto-optical disks, ROMs, Rams, EPROM's, EPROM's, Drams, Rams, flash memory devices, magnetic or optical cards, Nan systems (including molecular memory ICs), or any type of media or device suitable for storing instructions and/or data.

Stored on any one of the computer readable medium (media), the present invention includes software for controlling both the hardware of the general purpose/specialized computer or microprocessor, and for enabling the computer or microprocessor to interact with a human user or other mechanism utilizing the results of the present invention. Such software may include, but is not limited to, device drivers, operating systems, execution environments/containers, and user applications.

The foregoing description of preferred embodiments of the present invention has been provided for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to one of ordinary skill in the relevant arts. For example, steps performed in the embodiments of the invention disclosed can be performed in alternate orders, certain steps can be omitted, and additional steps can be added. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling others skilled in the art to understand the invention for various embodiments and with various modifications that are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims (17)

1. A web services security system comprising:
a computer, including a plurality of web services operating thereon which are configured to receive requests and provide responses in the form of messages, and wherein each web service has a security policy associated therewith;
a security framework including a plurality of security service provider interface (SSPI) which is configured to provide identity assertion, credential mapping, and validation of requests to the web services;
a web services security handler associated with each web service, which is configured to extract tokens from the messages directed as requests to that web service;
a token handler application programming interface (API) provided as an interface between the web services security handler and the security framework, which API can be instantiated to accept token types defined by the security policy for the web service, and convert the tokens extracted by the web services security handler to object credentials for processing by the security framework;
wherein when a message is received for a web service, the web services security handler associated with the web service
extracts tokens from the message according to the security policy, and
provides corresponding object credentials via the API to the security framework;
wherein the security framework then uses the object credentials to enable secured access to the web service; and
wherein the messages are simple object access protocol (SOAP) messages, and wherein the token handler API converts token XML in the SOAP messages into java object credentials.
2. The web services security system of claim 1, wherein the security services provider interface is a credential mapper SSPI.
3. The web services security system of claim 1, wherein the security services provider interface is a identity assertion SSPI.
4. The web services security system of claim 1, wherein the token handler API includes a number of sub-interfaces.
5. The web services security system of claim 1, wherein the messages are simple object access protocol (SOAP) messages, and wherein headers of the SOAP messages include the tokens.
6. The web services security system of claim 1, wherein the messages are simple object access protocol (SOAP) messages, and wherein headers of the SOAP messages include a reference to the tokens.
7. The web services security system of claim 1, wherein the SSPI connects to a security framework.
8. A method for providing web services security comprising:
providing a computer, and access to a plurality of web services operating thereon which are configured to receive requests and provide responses in the form of messages, and wherein each web service has a security policy associated therewith;
providing a security framework including a plurality of security service provider interface (SSPI) which is configured to provide identity assertion, credential mapping, and validation of requests to the web services;
providing a web services security handler associated with each web service, which is configured to extract tokens from the messages directed as requests to that web service; and
using a token handler application programming interface (API) provided as an interface between the web services security handler and the security framework, which API can be instantiated to accept token types defined by the security policy for the web service, to convert the tokens extracted by the web services security handler to object credentials for processing by the security framework, including
receiving a message for a web service,
extracting the tokens from the message according to the security policy,
providing corresponding object credentials via the API to the security framework, and
using the security framework with the object credentials to determine whether access to the web service as provided in the message is allowed;
wherein the messages are simple object access protocol (SOAP) messages, and wherein the token handler API converts token XML in the SOAP messages into java object credentials.
9. The method of claim 8, wherein the token handler API includes a number of sub-interfaces.
10. The method of claim 8, wherein the messages are simple object access protocol (SOAP) messages, and wherein headers of the SOAP messages include the tokens.
11. The method of claim 8, wherein the messages are simple object access protocol (SOAP) messages, and wherein headers of the SOAP messages include a reference to the tokens.
12. The method of claim 9, wherein the SSPI connects to a security framework.
13. A computer readable storage medium having instructions persistently stored thereon that when executed by a system including a processor cause the system to perform the steps comprising:
providing access to a plurality of web services which are configured to receive requests and provide responses in the form of messages, and wherein each web service has a security policy associated therewith;
providing a security framework including a plurality of security service provider interface (SSPI) which is configured to provide identity assertion, credential mapping, and validation of requests to the web services;
providing a web services security handler associated with each web service, which is configured to extract tokens from the messages directed as requests to that web service; and
using a token handler application programming interface (API) provided as an interface between the web services security handler and the security framework, which API can be instantiated to accept token types defined by the security policy for the web service, to convert the tokens extracted by the web services security handler to object credentials for processing by the security framework, including
receiving a message for a web service,
extracting the tokens from the message according to the security policy,
providing corresponding object credentials via the API to the security framework, and
using the security framework with the object credentials to determine whether access to the web service as provided in the message is allowed;
wherein the messages are simple object access protocol (SOAP) messages, and wherein the token handler API converts token XML in the SOAP messages into java object credentials.
14. The computer readable storage medium of claim 13, wherein the token handler API includes a number of sub-interfaces.
15. The computer readable storage readable medium of claim 13, wherein the messages are simple object access protocol (SOAP) messages, and wherein headers of the SOAP messages include the tokens.
16. The computer readable storage readable medium of claim 13, wherein the messages are simple object access protocol (SOAP) messages, and wherein headers of the SOAP messages include a reference to the tokens.
17. The computer readable storage readable medium of claim 13, wherein the SSPI connects to a security framework.
US11131554 2004-05-21 2005-05-18 Token handler API Active 2027-12-12 US7788716B2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US57326804 true 2004-05-21 2004-05-21
US11131554 US7788716B2 (en) 2004-05-21 2005-05-18 Token handler API

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US11131554 US7788716B2 (en) 2004-05-21 2005-05-18 Token handler API

Publications (2)

Publication Number Publication Date
US20050273844A1 true US20050273844A1 (en) 2005-12-08
US7788716B2 true US7788716B2 (en) 2010-08-31

Family

ID=35450470

Family Applications (1)

Application Number Title Priority Date Filing Date
US11131554 Active 2027-12-12 US7788716B2 (en) 2004-05-21 2005-05-18 Token handler API

Country Status (1)

Country Link
US (1) US7788716B2 (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080319996A1 (en) * 2007-06-20 2008-12-25 Cook Steven D Distributed Lock Manager For File System Objects In A Shared File System
US20130007184A1 (en) * 2011-06-30 2013-01-03 International Business Machines Corporation Message oriented middleware with integrated rules engine
US20130311771A1 (en) * 2012-05-17 2013-11-21 Cable Television Laboratories, Inc. Subscriber certificate provisioning
US8990942B2 (en) 2013-02-18 2015-03-24 Wipro Limited Methods and systems for API-level intrusion detection
US20150244706A1 (en) * 2014-02-26 2015-08-27 Secureauth Corporation Security object creation, validation, and assertion for single sign on authentication

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060005234A1 (en) * 2004-06-30 2006-01-05 International Business Machines Corporation Method and apparatus for handling custom token propagation without Java serialization
US7634803B2 (en) * 2004-06-30 2009-12-15 International Business Machines Corporation Method and apparatus for identifying purpose and behavior of run time security objects using an extensible token framework
US7526799B2 (en) * 2004-06-30 2009-04-28 International Business Machines Corporation Method for tracking security attributes along invocation chain using secure propagation token
US7559087B2 (en) * 2004-12-10 2009-07-07 Microsoft Corporation Token generation method and apparatus
US7747540B2 (en) * 2006-02-24 2010-06-29 Microsoft Corporation Account linking with privacy keys
US8656472B2 (en) 2007-04-20 2014-02-18 Microsoft Corporation Request-specific authentication for accessing web service resources
KR101238374B1 (en) * 2007-09-04 2013-02-28 삼성전자주식회사 Method and appratus for supplying mashup service
US20090182816A1 (en) * 2008-01-10 2009-07-16 Jean Xu Yu Method and system for managing j2ee and .net interoperating applications
US8572710B2 (en) * 2010-03-18 2013-10-29 Microsoft Corporation Pluggable token provider model to implement authentication across multiple web services
US8607054B2 (en) 2010-10-15 2013-12-10 Microsoft Corporation Remote access to hosted virtual machines by enterprise users
US8707449B2 (en) 2010-12-16 2014-04-22 International Business Machines Corporation Acquiring access to a token controlled system resource
US9477535B2 (en) * 2013-02-12 2016-10-25 Business Objects Software Ltd. Connection pool for accessing a backend processing system
US20160098616A1 (en) * 2014-10-02 2016-04-07 Facebook, Inc. Techniques for managing discussion sharing on a mobile platform
US9848064B2 (en) * 2015-11-05 2017-12-19 International Business Machines Corporation Generation and distribution of named, definable, serialized tokens

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030061404A1 (en) * 2001-09-21 2003-03-27 Corel Corporation Web services gateway
US20040015578A1 (en) * 2002-02-22 2004-01-22 Todd Karakashian Web services runtime architecture
US20040064503A1 (en) * 2002-02-22 2004-04-01 Bea Systems, Inc. System and method for web services Java API-based invocation
US20050114701A1 (en) * 2003-11-21 2005-05-26 International Business Machines Corporation Federated identity management within a distributed portal server
US7249373B2 (en) * 2003-01-15 2007-07-24 Microsoft Corporation Uniformly representing and transferring security assertion and security response information
US7533264B2 (en) * 2003-08-20 2009-05-12 Microsoft Corporation Custom security tokens
US7548620B2 (en) * 2004-02-23 2009-06-16 Verisign, Inc. Token provisioning

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030061404A1 (en) * 2001-09-21 2003-03-27 Corel Corporation Web services gateway
US20040015578A1 (en) * 2002-02-22 2004-01-22 Todd Karakashian Web services runtime architecture
US20040064503A1 (en) * 2002-02-22 2004-04-01 Bea Systems, Inc. System and method for web services Java API-based invocation
US7249373B2 (en) * 2003-01-15 2007-07-24 Microsoft Corporation Uniformly representing and transferring security assertion and security response information
US7533264B2 (en) * 2003-08-20 2009-05-12 Microsoft Corporation Custom security tokens
US20050114701A1 (en) * 2003-11-21 2005-05-26 International Business Machines Corporation Federated identity management within a distributed portal server
US7548620B2 (en) * 2004-02-23 2009-06-16 Verisign, Inc. Token provisioning

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080319996A1 (en) * 2007-06-20 2008-12-25 Cook Steven D Distributed Lock Manager For File System Objects In A Shared File System
US8990954B2 (en) * 2007-06-20 2015-03-24 International Business Machines Corporation Distributed lock manager for file system objects in a shared file system
US20130007184A1 (en) * 2011-06-30 2013-01-03 International Business Machines Corporation Message oriented middleware with integrated rules engine
US10140166B2 (en) * 2011-06-30 2018-11-27 International Business Machines Corporation Message oriented middleware with integrated rules engine
US20130311771A1 (en) * 2012-05-17 2013-11-21 Cable Television Laboratories, Inc. Subscriber certificate provisioning
US8850187B2 (en) * 2012-05-17 2014-09-30 Cable Television Laboratories, Inc. Subscriber certificate provisioning
US8990942B2 (en) 2013-02-18 2015-03-24 Wipro Limited Methods and systems for API-level intrusion detection
US20150244706A1 (en) * 2014-02-26 2015-08-27 Secureauth Corporation Security object creation, validation, and assertion for single sign on authentication

Also Published As

Publication number Publication date Type
US20050273844A1 (en) 2005-12-08 application

Similar Documents

Publication Publication Date Title
Gong Java security: Present and near future
US7353383B2 (en) System and method for single session sign-on with cryptography
US7475146B2 (en) Method and system for accessing internet resources through a proxy using the form-based authentication
US7219154B2 (en) Method and system for consolidated sign-off in a heterogeneous federated environment
Naedele Standards for XML and Web services security
US20060004662A1 (en) Method and system for a PKI-based delegation process
US20050154886A1 (en) Declarative trust model between reverse proxy server and websphere application server
US6335972B1 (en) Framework-based cryptographic key recovery system
US20060294366A1 (en) Method and system for establishing a secure connection based on an attribute certificate having user credentials
US20080168539A1 (en) Methods and systems for federated identity management
US7178163B2 (en) Cross platform network authentication and authorization model
US20040128542A1 (en) Method and system for native authentication protocols in a heterogeneous federated environment
US7590684B2 (en) System providing methodology for access control with cooperative enforcement
US20040139352A1 (en) Uniformly representing and transferring security assertion and security response information
US20080046715A1 (en) Method and apparatus for converting authentication-tokens to facilitate interactions between applications
US7533265B2 (en) Establishment of security context
US20070094493A1 (en) Digital certificate that indicates a parameter of an associated cryptographic token
US20120096533A1 (en) Application Identity Design
US20020073308A1 (en) Method and system for managing a distributed trust path locator for public key certificates relating to the trust path of an X.509 attribute certificate
US20020144109A1 (en) Method and system for facilitating public key credentials acquisition
US20060041636A1 (en) Policy processing model
US20060143700A1 (en) Security System Providing Methodology for Cooperative Enforcement of Security Policies During SSL Sessions
US20030221126A1 (en) Mutual authentication with secure transport and client authentication
US20050154889A1 (en) Method and system for a flexible lightweight public-key-based mechanism for the GSS protocol
US7392546B2 (en) System and method for server security and entitlement processing

Legal Events

Date Code Title Description
AS Assignment

Owner name: BEA SYSTEMS, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DAPKUS, PETER;WITT, CORINNA;REEL/FRAME:016583/0599

Effective date: 20050427

AS Assignment

Owner name: ORACLE INTERNATIONAL CORPORATION, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BEA SYSTEMS, INC.;REEL/FRAME:025192/0244

Effective date: 20101008

CC Certificate of correction
FPAY Fee payment

Year of fee payment: 4

MAFP

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552)

Year of fee payment: 8